Authentication of phone caller identity

ABSTRACT

According to one aspect of the present disclosure, a method and technique for caller authentication is disclosed. The method includes: responsive to initiation of a telephone call by a caller from a first telephone unit to a second telephone unit, retrieving an identification object comprising identification information corresponding to the caller; encrypting the identification object using an encryption key stored on the first telephone unit; and transmitting, as part of the telephone call, the encrypted caller identification object to a telephone network destined for the second telephone unit.

BACKGROUND

Mobile or wireless telephone units are used in both personal andbusiness applications. Telephone systems generally have the capabilityto provide caller identification services (caller ID) for identifying acalling party, such as displaying a telephone number and/or nameassociated with the calling party account. The caller ID information mayenable the called party to at least identify the telephone number and/orname that may be associated with a received call.

BRIEF SUMMARY

According to one aspect of the present disclosure a method and techniquefor authentication of caller identity is disclosed. The method includes:responsive to initiation of a telephone call by a caller from a firsttelephone unit to a second telephone unit, retrieving an identificationobject comprising identification information corresponding to thecaller; encrypting the identification object using an encryption keystored on the first telephone unit; and transmitting, as part of thetelephone call, the encrypted caller identification object to atelephone network destined for the second telephone unit.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

For a more complete understanding of the present application, theobjects and advantages thereof, reference is now made to the followingdescriptions taken in conjunction with the accompanying drawings, inwhich:

FIG. 1 is an embodiment of a network of data processing systems in whichthe illustrative embodiments of the present disclosure may beimplemented;

FIG. 2 is an embodiment of a data processing system in which theillustrative embodiments of the present disclosure may be implemented;

FIG. 3 is a diagram illustrating an embodiment of a data processingsystem for authentication of phone caller identity in which illustrativeembodiments of the present disclosure may be implemented;

FIG. 4 is a diagram illustrating a decryption key derivation forauthentication of caller identity in accordance with an embodiment ofthe present disclosure;

FIG. 5 is a diagram illustrating a data communication between a callingtelephone unit and a called telephone unit for authentication of calleridentity in accordance with an embodiment of the present disclosure;

FIG. 6 is a flow diagram illustrating an embodiment of a method forauthentication of caller identity in accordance with an embodiment ofthe present disclosure; and

FIG. 7 is a flow diagram illustrating another embodiment of a method forauthentication of caller identity in accordance with the presentdisclosure.

DETAILED DESCRIPTION

Embodiments of the present disclosure provide a method, system andcomputer program product for authentication of phone caller identity.For example, in some embodiments, the method and technique includes:responsive to initiation of a telephone call by a caller from a firsttelephone unit to a second telephone unit, retrieving an identificationobject comprising identification information corresponding to thecaller; encrypting the identification object using an encryption keystored on the first telephone unit; and transmitting, as part of thetelephone call, the encrypted caller identification object to atelephone network destined for the second telephone unit. Thus, in someembodiments of the present disclosure, a calling party encrypts anidentification object having information corresponding to an identity ofthe calling party and transmits the encrypted identification informationto the called party as part of the telephone call (e.g., inserted intothe body of the session initiation protocol (SIP) invitation). Thereceiving or called party may decrypt the received identification objectusing a decryption key previously received from the calling party orreceived from a third party certificate authority (e.g., a telephoneservice provider). The decrypted result may then be evaluated todetermine the authenticity of the identity of the calling party. Forexample, if the decrypted result is scrambled or illegible, theauthentication logic on the called telephone unit may return an error orother notice of failure of caller identity authentication. The receivingor called party may then reject the call, if desired.

As will be appreciated by one skilled in the art, aspects of the presentdisclosure may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present disclosure may take theform of an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present disclosure may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Any combination of one or more computer usable or computer readablemedium(s) may be utilized. The computer readable medium may be acomputer readable signal medium or a computer readable storage medium. Acomputer readable storage medium may be, for example but not limited to,an electronic, magnetic, optical, electromagnetic, infrared, orsemiconductor system, apparatus, or device, or any suitable combinationof the foregoing. More specific examples (a non-exhaustive list) of thecomputer readable storage medium would include the following: anelectrical connection having one or more wires, a portable computerdiskette, a hard disk, a random access memory (RAM), a read-only memory(ROM), an erasable programmable read-only memory (EPROM or Flashmemory), an optical fiber, a portable compact disc read-only memory(CD-ROM), an optical storage device, a magnetic storage device, or anysuitable combination of the foregoing. In the context of this document,a computer readable storage medium may be any tangible medium that cancontain, or store a program for use by or in connection with aninstruction execution system, apparatus or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent disclosure may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present disclosure are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of thedisclosure. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in acomputer-readable medium that can direct a computer or otherprogrammable data processing apparatus to function in a particularmanner, such that the instructions stored in the computer-readablemedium produce an article of manufacture including instruction meanswhich implement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer orother programmable data processing apparatus to cause a series ofoperational steps to be performed on the computer or other programmableapparatus to produce a computer implemented process such that theinstructions which execute on the computer or other programmableapparatus provide processes for implementing the functions/actsspecified in the flowchart and/or block diagram block or blocks.

With reference now to the Figures and in particular with reference toFIGS. 1-2, exemplary diagrams of data processing environments areprovided in which illustrative embodiments of the present disclosure maybe implemented. It should be appreciated that FIGS. 1-2 are onlyexemplary and are not intended to assert or imply any limitation withregard to the environments in which different embodiments may beimplemented. Many modifications to the depicted environments may bemade.

FIG. 1 is a pictorial representation of a network of data processingsystems in which illustrative embodiments of the present disclosure maybe implemented. Network data processing system 100 is a network ofcomputers and/or computing or data processing devices in which theillustrative embodiments of the present disclosure may be implemented.Network data processing system 100 contains network 130, which is themedium used to provide communications links between various devices andcomputers connected together within network data processing system 100.Network 130 may include connections, such as wire, wirelesscommunication links, or fiber optic cables.

In some embodiments, server 140 and server 150 connect to network 130along with data store 160. Server 140 and server 150 may be, forexample, IBM® Power Systems™ servers. In addition, clients 110 and 120connect to network 130. Clients 110 and 120 may be, for example,personal computers or network computers. In the depicted example, server140 provides data and/or services such as, but not limited to, datafiles, operating system images, and applications to clients 110 and 120.Network data processing system 100 may include additional servers,clients, and other devices.

In the depicted example, network data processing system 100 is theInternet with network 130 representing a worldwide collection ofnetworks and gateways that use the Transmission ControlProtocol/Internet Protocol (TCP/IP) suite of protocols to communicatewith one another. At the heart of the Internet is a backbone ofhigh-speed data communication lines between major nodes or hostcomputers, consisting of thousands of commercial, governmental,educational and other computer systems that route data and messages. Ofcourse, network data processing system 100 also may be implemented as anumber of different types of networks, such as for example, an intranet,a local area network (LAN), a wide area network (WAN), a telephoneswitching infrastructure, etc. FIG. 1 is intended as an example, and notas an architectural limitation for the different illustrativeembodiments.

FIG. 2 is an embodiment of a data processing system 200 such as, but notlimited to, client 110 and/or server 140 in which an embodiment of asystem for authenticating an identity of a telephone caller according tothe present disclosure may be implemented. In this embodiment, dataprocessing system 200 includes a bus or communications fabric 202, whichprovides communications between processor unit 204, memory 206,persistent storage 208, communications unit 210, input/output (I/O) unit212, and display 214.

Processor unit 204 serves to execute instructions for software that maybe loaded into memory 206. Processor unit 204 may be a set of one ormore processors or may be a multi-processor core, depending on theparticular implementation. Further, processor unit 204 may beimplemented using one or more heterogeneous processor systems in which amain processor is present with secondary processors on a single chip. Asanother illustrative example, processor unit 204 may be a symmetricmulti-processor system containing multiple processors of the same type.

In some embodiments, memory 206 may be a random access memory or anyother suitable volatile or non-volatile storage device. Persistentstorage 208 may take various forms depending on the particularimplementation. For example, persistent storage 208 may contain one ormore components or devices. Persistent storage 208 may be a hard drive,a flash memory, a rewritable optical disk, a rewritable magnetic tape,or some combination of the above. The media used by persistent storage208 also may be removable such as, but not limited to, a removable harddrive.

Communications unit 210 provides for communications with other dataprocessing systems or devices. In these examples, communications unit210 is a network interface card. Modems, cable modem and Ethernet cardsare just a few of the currently available types of network interfaceadapters. Communications unit 210 may provide communications through theuse of either or both physical and wireless communications links.

Input/output unit 212 enables input and output of data with otherdevices that may be connected to data processing system 200. In someembodiments, input/output unit 212 may provide a connection for userinput through a keyboard and mouse. Further, input/output unit 212 maysend output to a printer. Display 214 provides a mechanism to displayinformation to a user.

Instructions for the operating system and applications or programs arelocated on persistent storage 208. These instructions may be loaded intomemory 206 for execution by processor unit 204. The processes of thedifferent embodiments may be performed by processor unit 204 usingcomputer implemented instructions, which may be located in a memory,such as memory 206. These instructions are referred to as program code,computer usable program code, or computer readable program code that maybe read and executed by a processor in processor unit 204. The programcode in the different embodiments may be embodied on different physicalor tangible computer readable media, such as memory 206 or persistentstorage 208.

Program code 216 is located in a functional form on computer readablemedia 218 that is selectively removable and may be loaded onto ortransferred to data processing system 200 for execution by processorunit 204. Program code 216 and computer readable media 218 form computerprogram product 220 in these examples. In one example, computer readablemedia 218 may be in a tangible form, such as, for example, an optical ormagnetic disc that is inserted or placed into a drive or other devicethat is part of persistent storage 208 for transfer onto a storagedevice, such as a hard drive that is part of persistent storage 208. Ina tangible form, computer readable media 218 also may take the form of apersistent storage, such as a hard drive, a thumb drive, or a flashmemory that is connected to data processing system 200. The tangibleform of computer readable media 218 is also referred to as computerrecordable storage media. In some instances, computer readable media 218may not be removable.

Alternatively, program code 216 may be transferred to data processingsystem 200 from computer readable media 218 through a communicationslink to communications unit 210 and/or through a connection toinput/output unit 212. The communications link and/or the connection maybe physical or wireless in the illustrative examples.

The different components illustrated for data processing system 200 arenot meant to provide architectural limitations to the manner in whichdifferent embodiments may be implemented. The different illustrativeembodiments may be implemented in a data processing system includingcomponents in addition to or in place of those illustrated for dataprocessing system 200. Other components shown in FIG. 2 can be variedfrom the illustrative examples shown. For example, a storage device indata processing system 200 is any hardware apparatus that may storedata. Memory 206, persistent storage 208, and computer readable media218 are examples of storage devices in a tangible form.

FIG. 3 is an illustrative embodiment of a system 300 for authenticatingan identity of a calling party or telephone caller. As mentioned above,although some telephone systems enable caller identification (caller ID)information to be transmitted to a called party, there may be situationswhere caller ID information is unavailable or blocked. Additionally, acalling party may have the ability to create and transmit false ormisleading information to a called party (e.g., as part of the caller IDinformation or as a separate transmitted element of the call). System300 enables authentication of caller identity. System 300 may beimplemented on data processing systems or platforms such as, but notlimited to, servers 140 and/or 150, clients 110 and/or 120, or at otherdata processing system locations (e.g., on telephone or mobile/wirelessunits). For example, in the embodiment illustrated in FIG. 3, system 300comprises a certificate of authority 302 and having one or moreprocessor units 304 and a memory 306. In the embodiment illustrated inFIG. 3, memory 306 comprises a registration module 308 and account data310. Registration module 308 is used to register a telephone unit 312and/or a user/owner of telephone unit 312 to enable an identity of acaller or user of telephone unit 312 to be authenticated by a called orreceiving telephone unit. In some embodiments, certificate authority 302may comprise a telephone service provider; however, it should beunderstood that in some embodiments, certificate authority 302 maycomprise an entity other than a telephone service provider. Registrationmodule 308 may be implemented in any suitable manner using knowntechniques that may be hardware-based, software-based, or somecombination of both. For example, registration module 308 may comprisesoftware, logic and/or executable code for performing various functionsas described herein (e.g., residing as software and/or an algorithmrunning on a processor unit, hardware logic residing in a processor orother type of logic chip, centralized in a single integrated circuit ordistributed among different chips in a data processing system).

In the embodiment illustrated in FIG. 3, registration module 308includes a cryptographic module 320 for performing various functionsand/or operations corresponding to registering telephone unit 312 forcaller authentication. For example, in some embodiments, cryptographicmodule 320 is used to generate a set of encryption/decryption keyscorresponding to the registered telephone unit to enable a calleridentification object associated with the registered telephone unit tobe encrypted with a respective encryption key and decrypted by a calledtelephone unit with the respective decryption key. In the embodimentillustrated in FIG. 3, account data 310 comprises information associatedwith each registered telephone unit for which encryption and decryptionkeys have been generated. For example, in some embodiments, each user orowner 324 of a particular telephone unit may be assigned or haveassociated therewith a particular telephone number 326. For theparticular user 324 and/or telephone number 326, cryptographic module320 is used to generate an asymmetric key pair comprising an encryptionkey 328 and a decryption key 330. As will be described in further detailbelow, in connection with an outgoing telephone call by a telephoneunit, encryption key 328 is used to encrypt an identification objectcorresponding to the caller/user of the telephone unit, and decryptionkey 330 is used to decrypt an encrypted identification object receivedas part of a telephone call from another telephone unit. Theregistration of telephone unit 312 with certificate authority 302 and/orthe communication of encryption/decryption keys 328/330 may be performedover a communication network 332 such as, but not limited to, theInternet, a telephone switching network, or other type of communicationnetwork.

In the embodiment illustrated in FIG. 3, telephone unit 312 includes oneor more processor units 340 and a memory 342. In the illustratedembodiment, memory 342 includes a cryptographic module 350,authentication logic 352, and an identification object 354.Identification object 354 may comprise any type of object havingpersonally identifiable information corresponding to a user/owner oftelephone unit 312. For example, identification object 354 may comprisea text object (e.g., a vCard or other type of text file) including aname or other identifying information corresponding to the user (callingparty) of telephone unit 312, a digital image of the user, or other typeof information uniquely identifying the user to enable another telephoneunit (called party) to authenticate the identity of the calling party.Cryptographic module 350 is used to encrypt identification object 354 toenable the encrypted identification object 354 to be transmitted over atelephone switch network to a receiving telephone unit. Authenticationlogic 352 may be used to interface with certificate authority 302 toenable registration of telephone unit 312 with certificate of authority302 and/or obtain/receive encryption/decryption keys from thecertificate of authority 302. Authentication logic 352 may also be usedto analyze and/or otherwise verify an identification object (e.g., afterdecryption) received from another telephone unit. Cryptographic module350 and/or authentication logic 352 may be implemented in any suitablemanner using known techniques that may be hardware-based,software-based, or some combination of both. For example, cryptographicmodule 350 and/or authentication logic 352 may comprise software, logicand/or executable code for performing various functions as describedherein (e.g., residing as software and/or an algorithm running on aprocessor unit, hardware logic residing in a processor or other type oflogic chip, centralized in a single integrated circuit or distributedamong different chips in a data processing system).

In the illustrated embodiment, memory 342 also includesencryption/decryption data 360 comprising an encryption key 362 and, ifobtained by telephone unit 312, one or more decryption keys 364corresponding to other telephone units. Encryption key 362 comprises theencryption key generated by certificate of authority 302 and assigned totelephone unit 312 (e.g., encryption key 328 corresponding to aparticular telephone unit). In the illustrated embodiment, eachtelephone number 370 corresponding to another telephone unit isassociated with and/or otherwise related to a particular decryption key372 for decrypting an encrypted identification object received from atelephone unit corresponding to the particular telephone number 370. Thedecryption key 372 may be obtained by telephone unit 312 from thecertificate of authority 302 or directly from another telephone unit.

In operation, a user/owner or other entity may register telephone unit312 with certificate of authority 302 (e.g., upon initiation oftelephone service with a service provider or at another time) to enablethe generation of encryption key 328 to be used by telephone unit 312 toencrypt identification object 354 and the generation of decryption key330 to be used by other telephone units to decrypt an encryptedidentification object received from telephone unit 312. The encryptionkey 328 associated with the particular telephone number 326 assigned totelephone unit 312 (e.g., a telephone number stored on a subscriberidentity module (SIM) card of telephone unit 312) may be obtained fromcertificate of authority 302 and entered/stored manually in telephoneunit 312 (e.g., as encryption key 362) or obtained/receivedelectronically via network 332 from certificate of authority 302. Insome embodiments, only encryption key 328/362 is received by telephoneunit 312 from certificate of authority 302 while decryption key 330associated with telephone unit 312 may be obtained by other telephoneunits directly from certificate of authority 302. In other embodiments,decryption key 334 telephone unit 312 may also be obtained by telephoneunit 312 from certificate of authority 302 and stored on telephone unit312 to facilitate the transmittal of decryption key 332 to othertelephone units to thereafter enable such other telephone units todecrypt an encrypted identification object 354 received from telephoneunit 312. For example, in some embodiments, a user/owner of telephoneunit 312 may provide a user/owner of another telephone unit with itsdecryption key 330 by oral communication to enable another user/owner ofa telephone unit to enter/store decryption key 330 in their telephoneunit (e.g., by entering a code into the receiving party's telephone unitusing a keypad or other input device). In some embodiments, telephoneunit 312 may be configured to automatically transmit the decryption key330 associated with telephone unit 312 to another telephone unit (e.g.,in response to a user/owner of telephone unit 312 inputting a transmitrequest or other code such that telephone unit 312 automaticallytransmits decryption key 330 over a telephone switch network to thereceiving telephone unit, such as in the form of dual-tonemulti-frequency (DTMF) signals). The receiving telephone unit may beconfigured to prepare to accept a particular series of DTMF signals asthe decryption key 330 corresponding to the communicating telephone unit312 and store decryption key 330 as corresponding to the decryption keyfor telephone unit 312.

In response to initiation of a telephone call by telephone unit 312,authentication logic 352 may cause cryptographic module 350 to encryptidentification object 354 using encryption key 362 and transmit theencrypted identification object 354 to a receiving telephone unit aspart of the initiated telephone call (e.g., inserted into the body ofthe session initiation protocol (SIP) invitation). At the receivingtelephone unit, authentication logic 352 may identify the telephonenumber 370 of the initiating telephone unit 312 (e.g., via caller IDinformation) and determine/identify the decryption key 372 associatedwith the calling telephone unit 312 to enable decryption of the receivedencrypted identification object 354. The receiving telephone unitdecrypts the encrypted identification object 354 and authenticationlogic 352 on the receiving telephone unit may be used to verify and/orauthenticate the identity of the user/owner of the calling telephoneunit 312 (e.g., by evaluating the legibility of the decryptedidentification object 354 or by otherwise displaying to a user/owner ofthe receiving telephone unit the result of the decrypted identificationobject 354 to thereby enable the user/owner of the receiving telephoneunit to evaluate the decrypted result).

FIG. 4 is a diagram illustrating derivation of a decryption key 330 inresponse to receipt of a telephone call from another telephone unitincluding an encrypted identification object. In some embodiments,certificate of authority 302 may generate a decryption code 402 that isused in combination with a particular telephone number 326 to formdecryption key 330 corresponding to a calling telephone unit. Forexample, in some embodiments, decryption code 402 may comprise analphanumeric string that is combined with a numeric string correspondingto a particular telephone number 326 of the calling telephone unit toform decryption key 330 that is then used to decrypt a receivedencrypted identification object from the calling telephone unit. In someembodiments, the telephone number 326 of the calling telephone unit maybe derived from caller identification information that enablesidentification of the telephone number of the telephone unit initiatingthe telephone call. The receiving telephone unit may then access arelational database (e.g., decryption keys 364) to identify a particulardecryption code 402 associated with the caller telephone number 326.

FIG. 5 is a diagram illustrating authentication of phone caller identityin accordance with an embodiment of the present disclosure. In theillustrated embodiment, telephone unit 312 ₁ is initiating a telephonecall to a telephone unit 312 ₂. For illustrative purposes, telephoneunit 312 ₁ may correspond to a user 324 ₀ and have assigned theretotelephone number 326 ₀ (FIG. 3). Telephone unit 312 ₁ registered withcertificate of authority 302 and was assigned encryption key 328 ₀ anddecryption key 330 ₀. At least encryption key 328 ₀ is stored ontelephone unit 312 ₁ (in some embodiments, decryption key 330 ₀ may alsobe stored on telephone unit 312 ₁). Telephone unit 312 ₂ may also haveregistered with certificate of authority 302 and had assigned theretofor a user 324 ₁ a telephone number 326 ₁ along with an encryption key328 ₁ and a decryption key 331 ₁. At least encryption key 328 ₁ isstored on telephone unit 312 ₂ (in some embodiments, decryption key 330₁ may also be stored on telephone unit 312 ₂).

During a previous telephone communication exchange between telephoneunits 312 ₁ and 312 ₂, telephone unit 312 ₁ may have transmitted totelephone unit 312 ₂ its decryption key 330 ₀. In some embodiments,telephone unit 312 ₂ may have received decryption key 330 ₀ directlyfrom certificate authority 302. Telephone unit 312 ₂ stores thereindecryption key 330 ₀ as corresponding to the telephone number 326 ₀.

In operation, telephone unit 312 ₁ initiates a telephone call totelephone unit 312 ₂, and as part of the initiated telephone call,retrieves its identification object 354 and encrypts identificationobject 354 with encryption key 328 ₀. Telephone unit 312 ₂ transmits theencrypted identification object 354 to a telephone switch network 500destined to telephone unit 312 ₂. Telephone unit 312 ₂ receives theencrypted identification object 354 along with caller identificationinformation (e.g., telephone number 326 ₀ corresponding to telephoneunit 312 ₁). Authentication logic 352 on telephone unit 312 ₂ determinesand/or identifies the decryption key corresponding to telephone number326 ₀ (e.g., decryption key 330 ₀) and decrypts the received encryptedidentification object 354 using cryptographic module 350. As indicatedabove, in some embodiments, decryption key 330 ₀ may be formed based ona combination of telephone number 326 ₀ and a particular decryption code402 assigned to telephone number 326 ₀. Authentication logic 352 ontelephone unit 312 ₂ evaluates and/or otherwise displays the result ofthe decryption to authenticate the calling party of telephone unit 312₁.

As discussed above, telephone unit 312 ₂ may have stored thereon aplurality of correlated telephone numbers and decryption keyscorresponding to a plurality of other telephone units such that anencrypted identification object received from any such other telephoneunit may be decrypted using a corresponding decryption key. Thedecryption keys corresponding to such other telephone units may havebeen obtained directly from certificate authority 302 or directly fromthe other telephone units. For example, as described above, during aprevious communication exchange between telephone unit 312 ₁ andtelephone unit 312 ₂, a user/owner of telephone unit 312 ₁ may haveinitiated a transmittal of its decryption key 330 ₀ to telephone unit312 ₂ by inputting a particular code or request input (e.g., inputting apasscode, pin or other input into a keypad of telephone unit 312 ₁). Auser/owner of telephone unit 312 ₂ may have initiated a process ontelephone unit 312 ₂ to receive, accept, assign and store on telephoneunit 312 ₂ the received decryption key 330 ₀ as corresponding totelephone number 326 ₀, thereby enabling subsequently received encryptedidentification objects 354 from telephone unit 312 ₁ to be decrypted andthe identity of the caller authenticated.

FIG. 6 a flow diagram illustrating an embodiment of a method forauthentication of phone caller identity. The method begins at block 602,where telephone unit 312 is registered with certificate authority 302.At block 604, certificate authority 302 generates encryption key 328 anddecryption key 330 for the registered telephone unit 312. At block 606,telephone unit 312 receives and stores therein an encryption key 328. Atblock 608, telephone unit 312 receives and stores therein decryption key330. At block 610, identification object 354 is generated containingpersonally identifiable information corresponding to a caller/owner oftelephone unit 312. At block 612, telephone unit 312 initiates a call toanother telephone unit. At block 614, authentication logic 352 retrievesidentification object 354 and encrypts identification object 354 withencryption key 328. At block 616, telephone unit 312 transmits theencrypted identification object 354 to the telephone switch network 502destined for the called telephone unit.

FIG. 7 is a flow diagram illustrating another embodiment of a method forauthentication of phone caller identity. The method begins at block 702,where a telephone unit (e.g., telephone 312 ₂) obtains and/or retrievesa decryption key 330 and/or decryption code 402 for a desired orparticular telephone unit (e.g., for telephone unit 312 ₁). At block704, a call is received from another telephone unit (e.g., a call isreceived by telephone unit 312 ₂ from telephone unit 312 ₁). At block706, the telephone unit receives an encrypted identification object 354from the calling telephone unit (e.g., telephone unit 312 ₂ receives anencrypted identification object 354 from telephone unit 312 ₁). At block708, the telephone unit determines and/or otherwise identifies thedecryption key/code corresponding to the calling telephone unit (e.g.,determines and/or otherwise identifies the decryption key/code 330 ₀/402corresponding to telephone unit 312 ₁ based on telephone number 326 ₀).At block 710, authentication logic 352 and/or cryptographic module 350on the receiving telephone unit is used to decrypt the receivedencrypted identification object 354. At block 712, authentication logic352 authenticates the identity of the calling party (e.g., by evaluatingand/or verifying the legibility of the decrypted identification object354 (e.g., by parsing various portions of the decrypted result thatshould correspond to a common or expected data format), by displayingthe result of the decryption to the user/owner of the receivingtelephone unit or otherwise evaluating the result of the decryption).

Thus, embodiments of the present disclosure enable authentication of acaller's identity in a mobile or wireless phone call. For example,embodiments of the present disclosure enable a calling party to encryptan identification object having information corresponding to an identityof the calling party and transmit the encrypted identificationinformation to the called party as part of the telephone call (e.g.,inserted into the body of the session initiation protocol (SIP)invitation). The receiving or called party may decrypt the receivedidentification object using a decryption key previously received fromthe calling party or received from a third party certificate authority(e.g., a telephone service provider). The decrypted result may then beevaluated to determine the authenticity of the identity of the callingparty. For example, if the decrypted result is scrambled or illegible,the authentication logic 352 may return an error or other notice offailure of caller identity authentication. The receiving or called partymay then reject the call, if desired.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the disclosure.As used herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below are intended toinclude any structure, material, or act for performing the function incombination with other claimed elements as specifically claimed. Thedescription of the present disclosure has been presented for purposes ofillustration and description, but is not intended to be exhaustive orlimited to the disclosure in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the disclosure. Theembodiment was chosen and described in order to best explain theprinciples of the disclosure and the practical application, and toenable others of ordinary skill in the art to understand the disclosurefor various embodiments with various modifications as are suited to theparticular use contemplated.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

What is claimed is:
 1. A method, comprising: responsive to initiation ofa telephone call by a caller from a first telephone unit to a secondtelephone unit, retrieving an identification object comprisingidentification information corresponding to the caller; encrypting theidentification object by the first telephone unit using an encryptionkey stored on the first telephone unit, the encryption key associatedwith a telephone number assigned to the first telephone unit; andtransmitting, as part of the telephone call, the encrypted calleridentification object from the first telephone unit to a telephonenetwork destined for the second telephone unit.
 2. The method of claim1, further comprising: registering the first telephone unit with acertificate authority; and responsive to registering the first telephoneunit with the certificate authority, receiving and storing, on the firsttelephone unit, the encryption key from the certificate authority. 3.The method of claim 2, wherein registering the first telephone unitcomprises registering the first telephone unit with a telephone serviceprovider.
 4. The method of claim 2, further comprising, responsive toregistering the first telephone unit with the certificate authority,receiving a decryption key from the certificate authority for decryptingthe encrypted caller identification object.
 5. The method of claim 4,further comprising transmitting the decryption key to the telephonenetwork destined for the second telephone unit.
 6. The method of claim4, further comprising: storing the decryption key on the first telephoneunit; and responsive to receiving an input requesting a transmission ofthe decryption key, automatically transmitting the decryption key to thetelephone network destined for the second telephone unit.
 7. The methodof claim 1, further comprising: responsive to receiving a call from thesecond telephone unit, identifying an encrypted identification objectreceived from the second telephone unit; identifying a decryption keyassociated with the call from the second telephone unit; decrypting theidentification object received from the second telephone unit; andverifying an identity of a caller placing the call from the secondtelephone unit based on the decrypted identification object.
 8. Themethod of claim 7, wherein identifying the decryption key associatedwith the call comprises identifying a telephone number associated withthe call from the second telephone unit.
 9. A system, comprising: afirst telephone unit having a processor and logic executable by theprocessor, the logic executable by the processor to: responsive toinitiation of a telephone call by a caller from the first telephone unitto a second telephone unit, retrieve an identification object comprisingidentification information corresponding to the caller; encrypt theidentification object using an encryption key stored on the firsttelephone unit, the encryption key associated with a telephone numberassigned to the first telephone unit; and transmit, as part of thetelephone call, the encrypted caller identification object to atelephone network destined for the second telephone unit.
 10. The systemof claim 9, wherein the logic is executable to, responsive toregistering the first telephone unit with a certificate authority,receive and store, on the first telephone unit, the encryption key fromthe certificate authority.
 11. The system of claim 10, wherein the logicis executable to receive the encryption key from a telephone serviceprovider as the certificate authority.
 12. The system of claim 10,wherein the logic is executable to, responsive to registering the firsttelephone unit with the certificate authority, receive a decryption keyfrom the certificate authority for decrypting the encrypted calleridentification object.
 13. The system of claim 12, wherein the logic isexecutable to transmit the decryption key to the telephone networkdestined for the second telephone unit.
 14. The system of claim 12,wherein the logic is executable to: store the decryption key on thefirst telephone unit; and responsive to receiving an input requesting atransmission of the decryption key, automatically transmit thedecryption key to the telephone network destined for the secondtelephone unit.
 15. The system of claim 9, wherein the logic isexecutable to: responsive to receiving a call from the second telephoneunit, identify an encrypted identification object received from thesecond telephone unit; identify a decryption key associated with thecall from the second telephone unit; decrypt the identification objectreceived from the second telephone unit; and verify an identity of acaller placing the call from the second telephone unit based on thedecrypted identification object.
 16. A computer program product forauthentication of phone caller identity, the computer program productcomprising: non-transitory computer readable medium having computerreadable program code embodied therewith, the computer readable programcode comprising computer readable program code configured to: responsiveto initiation of a telephone call by a caller from a first telephoneunit to a second telephone unit, retrieve an identification objectcomprising identification information corresponding to the caller;encrypt the identification object by the first telephone unit using anencryption key stored on the first telephone unit, the encryption keyassociated with a telephone number assigned to the first telephone unit;and transmit, as part of the telephone call, the encrypted calleridentification object from the first telephone unit to a telephonenetwork destined for the second telephone unit.
 17. The computer programproduct of claim 16, wherein the computer readable program code isconfigured to, responsive to registering the first telephone unit with acertificate authority, receive and store, on the first telephone unit,the encryption key from the certificate authority.
 18. The computerprogram product of claim 17, wherein the computer readable program codeis configured to receive the encryption key from a telephone serviceprovider as the certificate authority.
 19. The computer program productof claim 16, wherein the computer readable program code is configuredto, responsive to registering the first telephone unit with thecertificate authority, receive a decryption key from the certificateauthority for decrypting the encrypted caller identification object. 20.The computer program product of claim 19, wherein the computer readableprogram code is configured to transmit the decryption key to thetelephone network destined for the second telephone unit.
 21. Thecomputer program product of claim 16, wherein the computer readableprogram code is configured to: responsive to receiving a call from thesecond telephone unit, identify an encrypted identification objectreceived from the second telephone unit; identify a decryption keyassociated with the call from the second telephone unit; decrypt theidentification object received from the second telephone unit; andverify an identity of a caller placing the call from the secondtelephone unit based on the decrypted identification object.
 22. Amethod, comprising: responsive to receiving, by a first telephone unit,a call from a second telephone unit, identifying an encryptedidentification object received from the second telephone unit;identifying a telephone number corresponding to the second telephoneunit; determining a decryption key associated with the call from thesecond telephone unit based on the telephone number; decrypting theidentification object received from the second telephone unit with thedecryption key; and verifying an identity of a caller placing the callfrom the second telephone unit based on the decrypted identificationobject.
 23. The method of claim 22, wherein determining the decryptionkey comprises generating the decryption key by combining the telephonenumber with a decryption code.
 24. The method of claim 23, furthercomprising receiving the decryption code from a certificate authoritybased on the telephone number.
 25. The method of claim 22, whereinverifying the identity of the caller comprises evaluating the legibilityof the decrypted identification object.